Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
01/06/2024, 18:29
General
-
Target
2e79885e3c34c6b23120b736b8655d2e629d085ba3cbf8ae67dda52ab968b762.exe
-
Size
75KB
-
MD5
01d47517605354918c7e4f0cd732634b
-
SHA1
db586b441cdc3e4b9285c56313a2bd0d3ae5490d
-
SHA256
2e79885e3c34c6b23120b736b8655d2e629d085ba3cbf8ae67dda52ab968b762
-
SHA512
01f4fa6bbc52547daf001f7af10de103dbaa766367a5b8f4199b5dcc9bd3966374d6fe833bbe803adcb1b53639b4e808b381ca3979882e0b08947f49e96d392a
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOfv:RshfSWHHNvoLqNwDDGw02eQmh0HjWOfv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e79885e3c34c6b23120b736b8655d2e629d085ba3cbf8ae67dda52ab968b762.exe"C:\Users\Admin\AppData\Local\Temp\2e79885e3c34c6b23120b736b8655d2e629d085ba3cbf8ae67dda52ab968b762.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5bc91ceb7c4283f85a31e1f4b9044789f
SHA186988e482a06372a6dd83f99017fc58699038902
SHA256d4f700bff7d87d1f9e80066f475c860759a24302025ea2a959bb5d9aba1457a6
SHA51204aff858f862fc883a3f243269240435cbf0ba55411ba0bcf7b896f98357deb6e6a0045ba1840ac7fa30cf9a8ad54e4fe578595418e6dd8633111c994f178ead
-
Filesize
82KB
MD527fefe4be8f50e8ccc66a92ea6f9bf5e
SHA1ecba20289d7dbd0bf8be342cb7c2885645298d34
SHA2563881df844df673c86fb33b2141ea83498cee536faab23095d975a2f1965f9cf6
SHA512020198b7fbde950f89a20513ddc3db9b17d159d04e014d23f90af71cda13fdd25a97cd90792e4eecc527b5e8cdfdb9a488faa39b56745de98ceb40deb2fb232b
-
Filesize
86KB
-
Filesize
86KB